3-container architecture: This HTML is served by nginx with a strict nonce-based Content Security Policy. Authentication and token storage run in a separate auth service container. The backend API is a third container. Tokens never reach the browser.